Reverse Engineering iTag – A Bluetooth Low Energy Button

Couple of weeks back I bought a few iTags. These are simple BLE buttons. They have a small led, a button and a buzzer. CR2032 – a 3v coin cell battery powers it. Since they are Bluetooth Low Energy devices, a single cell can power them for years. It’s easy to change batteries if they run out of power. Bought individually they cost about ₹200 but on AliBaba you can buy a dozen for ₹1500. They are usually used with phones as an extra remote button or as a leash for key chain. I wanted to use them as a remote button with an App I was building. Hence the reverse engineering.

I began with installing nRF Connect android App. nRF Connect is a BLE Swiss army knife. You can scan, advertise and explore BLE devices with it. You can also connect and communicate with them.

Once you connect to the iTag using nRF connect, you can explore the services and characteristics. You can also press the button on iTag to see which characteristic changes. I have the XML above which is the copy of ITag services and characteristics. Its copied using nRF connect. You can see it supports two standard services Battery service and Immediate alert service. They are very well-defined and works as defined.

Once connected nRF connect shows all the services available on iTag device

Once connected you can explore the services and characteristics.

You can even send (data) or alerts to the iTag device.

The third one which is a custom service is the interesting one. It is attached to the button. It sends a notification when the button is clicked. On a client (Eg: Mobile app) you can subscribe to notification on this characteristics. You will get notified every time the button gets clicked.

Play store has many apps that can be used with iTags. They provide options like taking a selfie using the button etc. There are other apps which allow you to attach events to tasker app. I found an open source app called ITracing2. This one is the most versatile app that allows you to send events to other apps or internet. The app code is clean and very readable. Since I was studying the protocol, I took time to read code and fixed a bug while I was there. Hence this is my recommended app :) I use this app in two ways. The diagram clearly shows the flow of event. You can set up these flows the Itracing App. Itracing App also provides the feature of double-click. Two successive clicks from iTag button within a preset time period is a double-click. I have this double-click period set as 300ms. You can change this period. So if I click the button twice within 300ms then its a double-click else single click. That gives an extra event for us to play with.

Lists all the iTag devices available. You can enable (connect to) them

Once connected you can see the power of cell battery on iTag

Setup action for button press event. You can setup action for single click and double click

Other than these generic app setups. If you are an app developer then you can integrate this feature into your own app. Almost every iTag manufacturer now uses characteristics 0000ffe1-0000-1000-8000-00805f9b34fb to send button click. It’s almost a standard now. So if your app needs an external button feature then this is an option.

On Android its super simple. Enable notification of the simple key service and characteristics.

Let me know if you have any questions or used the button in an innovative way. I would love to hear.

A note about Privacy; These low-cost iTags have a hard-coded mac address. Hence they can be tracked quite easily. This is something that you need to keep in mind. I will write about BLE privacy issues later.

10 Responses

I want to use mine as a keyfinder, but the problem is, when it goes out of range, it starts beeping, which is annoying. It also has a power saving mode that shuts it down if it isn’t connected to anything.

Ideally, my plan would be to reprogram it to disable the power saving mode, so that I can connect to the device only whenever I lose it.

Thanx for this article, I was looking for something to recognize key presses on BLE tracker and found about iTracking2 here… great software. I have been googling like 30 minutes on how to integrate BLE tag with Tasker and this is the only article that sucessfully deals with it :) Thanx!

Hi. Nice write up and I appreciate all the work you have done. I just purchased one of these BLE tags and I would like to create a tasker event with the help of iTracing2 call broadcast intent function. My problem is that I don’t know how to get started. I would like to use my iTag for opening Google Voice Search on my phone when I press the button in the iTag.

I want to call broadcast intent with iTracing2 and receive it with Tasker. I just don’t know how to set up this intent.

has anyone figured out how to turn of this “power saver” or autoshutoff? if you could disable that on these – would be a lot more useful.
as is you that shut off and become useless.
anyone any solution?

Archives

Archives

Copyright and Disclosure

(C) Thejesh GN.The views expressed on this site are mine (Thejesh GN) alone and do not necessarily reflect the views of my employer. Please read the terms and conditions before reading or commenting on this blog.